[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

An organization completes its Current Profile by indicating which Category and Subcategory outcomes from the remaining Functions are being achieved. If an outcome is partially achieved, noting this fact will help support subsequent steps by providing baseline information. Informed by the activities under Identify and Govern, such as organizational privacy values and policies, organizational risk tolerance, and privacy risk assessment results, an organization completes its Target Profile focused on the assessment of the Categories and Subcategories describing its desired privacy outcomes. An organization also may develop its own additional Functions, Categories, and Subcategories to account for unique organizational risks. It may also consider influences and requirements of external stakeholders such as

Since either a Current or Target Profile can be used to generate a prioritized list of privacy requirements, these Profiles can also be used to inform decisions about buying products and services. By first selecting outcomes that are relevant to its privacy goals, an organization then can evaluate partners' systems, products, or services against this outcome. For example, if a device is being purchased for environmental monitoring of a forest, manageability may be important to support capabilities for minimizing the processing of data about people using the forest and should drive a manufacturer evaluation against applicable Subcategories in the Core (e.g., CT.DP-P4: system or device configurations permit selective collection or disclosure of data elements ).

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Application Container Security Guide:

アプリの脆弱性 | ..........................................................................................................................................18 | | 3.4.5 未承認コンテナ ..........................................................................................................................................18 | | | 3.5 ホスト OS のリスク ..........................................................................................................................................18 | | | 3.5.1 大きなアタックサーフェス | ........................................................................................................................18 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Building Secure Microservices-based Applications Using Service-Mesh Architecture:

- Circuit breaker: Large-scale distributed systems, no matter how they are architected, have one defining characteristic-they provide many opportunities for small, localized failures to escalate into system-wide catastrophic failures. The Service Mesh must be designed to safeguard against these escalations by shedding load and failing quickly when the underlying systems approach their limits. Circuit breaking involves setting a threshold for the failed responses from an instance of a microservice and cutting off forwarding requests to that instance when the failure is above the threshold (e.g., when the circuit breaker trips). This mitigates the possibility of cascading failure and allows for time to analyze logs, implement the necessary fix, and push an update for the failing instance. Thus, circuit breaking is a temporary measure that prevents total disruption to responses for service requests. The service requests will be restored to the instance once the service is responsive.
- Rate limiting (throttling): The rate of requests coming into a microservice must be limited to ensure continued availability of service for all clients.
- Blue/green deployments: When a new version of a microservice is deployed, requests from customers using the old version can be redirected to the new version using the API gateway that can be programmed to maintain awareness of the locations of both versions.
- Canary releases: Only a limited amount of traffic is initially sent to a new version of a microservice since the correctness of its response or performance metric under all operating scenarios is not fully known. Once sufficient data is gathered about its operating characteristics, then all of the requests can be proxied to the new version of the microservice.

Building Secure Microservices-based Applications Using Service-Mesh Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Computer Security Division 2012 Annual Report:

|
| Security Outreach and Integration Group................ | 5                                              |
| Security Testing, Validation, and Measurement Group...
| 6                                              |
| The Computer Security Division Implements the Federal Information Security Management Act of 2002......................................................7 |                                                |
| CSD's Programs/Projects for FY2012..................8                                                                                |                                                |
| CSD Work in National and International Standards.....

Computer Security Division 2012 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Codes for Identification of Federal and Federally-Assisted Organizations:

Protection Agency | | | Field Activities of the Department of Defense | | 97F1 | American Forces Information Service | | 9758 | Defense Prisoner of War/Missing Personnel Office | | 97AU | Defense Technology Security Administration | | 9748 | Defense Human Resources Activity | | 97F2 | Department of Defense Education Activity | | 97F6 | Office of Economic Adjustment | | 97F5 | Washington Headquarters Services | | 9760 | TRICARE Management Activity |

Codes for Identification of Federal and Federally-Assisted Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Computer Security Division 2010 Annual Report:

Issued fifteen final NIST Special Publications (SP) that addressed management,  operational  and  technical  security  guidance  in areas  such  as,  securing WiMax  wireless  networks,  secure  con tent  automation  protocols,  protection  of  personally  identifi able information, Bluetooth security, and deployment of Secure Domain Name System deployment. In addition, eight draft SPs were issued for public comment for cryptographic key deploy ment  and  security  configuration  management  among  other topics;

- Continued the successGLYPH(cmap:df00)ul collaboration with the OGLYPH(cmap:df00) GLYPH(cmap:df00) i ce oGLYPH(cmap:df00) the Director  of  National  Intelligence,  Committee  on  National Security Systems and the Department of Defense to estab lish  a  common foundation for information security across the federal government, including a consistent process for selecting and specifying safeguards and countermeasures (i.e., security controls) for federal information systems;
- Provided assistance to agencies and private sector: Conducted  ongoing,  substantial  reimbursable  and  non-reim bursable assistance support, including many outreach ef forts such as the Federal Information Systems Security Edu cators' Association (FISSEA), the Federal Computer Security Program  Managers' Forum  (FCSM  Forum),  and  the  Small Business Corner;
- As part oGLYPH(cmap:df00) its contribution to the Smart Grid initiative, CSD released NIST IR 7628, Guidelines for Smart Grid Cyber Security, in August 2010;
- Reviewed security policies and technologies GLYPH(cmap:df00)rom the private  sector  and  national  security  systems  for  potential federal agency use: hosted a growing repository of federal agency security practices, public/private security practices, and security configuration checklists for IT products.

Computer Security Division 2010 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Part 3)

[Assistant]
h  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Submit comments on this publication to:

cyberhygiene@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

Enterprise patch management is the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization. Patching is more important than ever because of the increasing reliance on technology, but there is often a divide between business/mission owners and security/technology management about the value of patching.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

- o PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties - o PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk - Awareness and Training (PR.AT): The organization's personnel are provided with cybersecurity awareness and training so that they can perform their cybersecurity-related tasks - o PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind - o PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind - Data Security (PR.DS): Data are managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information - o PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected - o PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected - o PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected - o PR.DS-11: Backups of data are created, protected, maintained, and tested - Platform Security (PR.PS): The hardware, software

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Proceedings of the Workshop of the Federal Criteria for Information Technology Security:

blems. The component group also felt that the document organization should be re-examined and the Federal Criteria should be minimized. They also would have liked to have seen the fimctional packages.
The component group also felt that the Federal Criteria should limit the requirement statements to accepted engineering practices rather than research ideas (but not exclude adding new accepted ideas), but the global issues groi^ didn't see how this statement applied to the Federal Critoia - the only research idea that they could remember was real time audit alarms. The component group identified several items that they felt were not well accepted. These included the requirements for both functional and penetration testing as defined in the Federal CMteria since they are significantly different from the ITSEC and TCSEC, the requirement for using 'high-level synchronization,' the allowance for layering violation, and the use of multi-threaded tasks for Trusted Computing Base (TCB) structuring.

Proceedings of the Workshop of the Federal Criteria for Information Technology Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Computer Security Log Management:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. 21 Some organizations, particularly smaller ones, may choose to have a single log management infrastructure used throughout the enterprise. For most organizations, a single infrastructure is not feasible for any of several reasons, including limitations on the scalability of a single infrastructure, logging occurring on logically or physically separate networks, concern about robustness (e.g., having a single infrastructure means that a failure of that infrastructure affects logging throughout the organization), and interoperability issues among log generators and infrastructure components. Communications between log management infrastructure components typically occur over an organization's regular networks because the hosts generating log data may be located throughout the organization's networks. However, a physically or logically separate logging network can be used, particularly for getting logs from key devices (e.g., firewalls and network intrusion detection systems that often transfer large amounts of log data) and for transferring log data between log servers.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Services Acquisition?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

...............................................................................17        |                                                                                |
| 4.1.5.
| Authentication Mechanisms...................................................................................17                 |                                                                                |
| Enterprise Mobile Security Technologies...................................................................18 | Enterprise Mobile Security Technologies...................................................................18                   |                                                                                |
| 4.2.1. | Enterprise Mobility Management............................................................................18                   |                                                                                |
| 4.2.2. | Mobile Application Management............................................................................20                    |                                                                                |
| 4.2.3. | Mobile Threat Defense...........................................................................................21             |                                                                                |
| 4.2.4. | Mobile App Vetting.................................................................................................22          |                                                                                |
| 4.2.5. | Virtual Mobile Infrastructure ...................................................................................22            |                                                                                |
| 4.2.6.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Information Security Guide for Government Executives:

Over time, information security efforts may need to be revisited because of changes in agency mission, operational requirements, threats, environment, or deterioration in the degree of compliance. Periodic assessments and reports on activities can be a valuable means of identifying areas of noncompliance. Reminding employees of their responsibilities and demonstrating management's commitment to the security program are key to maintaining effective security within the constantly changing information security environment. Executives should ensure a life-cycle approach to compliance by monitoring the status of their programs to ensure that:

Implementing a robust information security program within the federal government is challenging. Federal executives have to contend with constantly changing technology, multiple compliance requirements, increasing complexity of information security, and changing threats. However, the executive can navigate these challenges and accomplish an organization's critical information security goals.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

This guide provides general implementation guidance (Volume 1) and example proof-of-concept solutions demonstrating how available open-source and commercial off-the-shelf (COTS) products could be implemented in manufacturing environments to satisfy the requirements in the Cybersecurity Framework (CSF) Manufacturing Profile [8] Low Impact Level. A manufacturing system could be classified as Low potential impact if the loss of integrity, availability, or confidentiality could be expected to have a limited adverse effect on manufacturing operations, manufactured product, assets, brand image, finances, personnel, the general public, or the environment. A limited adverse effect means that, for example, the loss of integrity, availability, or confidentiality might:

Many small and medium-sized manufacturers have expressed challenges in implementing a standards-based cybersecurity program. This guide provides general implementation guidance (Volume 1) and example proof-of-concept solutions demonstrating how available open-source and commercial off-the-shelf (COTS) products could be implemented in manufacturing environments to satisfy the requirements in the Cybersecurity Framework (CSF) Manufacturing Profile [8] Low Impact Level. A manufacturing system could be classified as Low potential impact if the loss of integrity, availability, or confidentiality could be expected to have a limited adverse effect on manufacturing operations, manufactured product, assets, brand image, finances, personnel, the general public, or the environment. A limited adverse effect means that, for example, the loss of integrity, availability, or confidentiality might:

The Cybersecurity Program document establishes guidelines and principles for initiating, implementing, maintaining, and improving information security management of the organization. It is a documented set of the organization's security policies, procedures, guidelines and standards.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Derived PIV Application and Data Model Test Guidelines provide? (Part 5)

[Assistant]
interface, data object container size and access requirements. + Enable issuers of Derived PIV Credentials to ensure that Derived PIV data objects conform to the requirements specified in SP 800-157.
+ Enable developers and issuers to develop self-tests as part of the development effort and issuance process. + Enable entities performing conformance tests on Derived PIV Applications and Derived PIV data objects to develop tests that cover the test suite provided in this document. ## Table of Contents

| 1.

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.10 (NIST 3.1.10)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.1.10. 3.1.10.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Managing the Security of Information Exchanges:

3.3.1 Maintain Clear Lines of Communication... 3.3.10 Review the Continued Need for the Information Exchange ... 3.3.1 Maintain Clear Lines of Communication

It is critical that the organizations participating in an information exchange maintain clear lines of communication and communicate regularly.

Managing the Security of Information Exchanges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does 2017 NIST_ITL Cybersecurity Program Annual Report provide?

[Assistant]
<!-- image -->

## ANNUAL REPORT 2017 NIST/ITL CYBERSECURITY PROGRAM

<!-- image -->

## THIS PAGE IS INTENTIONALLY LEFT BLANK

## ANNUAL REPORT 2017

## NIST/ITL CYBERSECURITY PROGRAM

## PATRICK O'REILLY, EDITOR

Computer Security Division Information Technology Laboratory

## KRISTINA RIGOPOULOS, EDITOR

Applied Cybersecurity Division Information Technology Laboratory

CO-EDITORS: Larry Feldman Greg Witte G2, Inc. Annapolis Junction, Maryland

THIS PUBLICATION IS AVAILABLE FREE OF CHARGE FROM https:/ /doi.org/10.6028/NIST.SP.800-203

JULY 2018

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Wilbur L. Ross, Jr., Secretary

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## AUTHORITY

This  publication  has  been  developed  by  the  National  Institute  of  Standards and  Technology  (NIST)  in  accordance  with  its  statutory  responsibilities  under  the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards  and  guidelines,  including  minimum  requirements  for  federal  information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines  made  mandatory  and  binding  on  federal  agencies  by  the  Secretary  of Commerce  under  statutory  authority. Nor  should  these  guidelines  be  interpreted as  altering  or  superseding  the  existing  authorities  of  the  Secretary  of  Commerce, Director  of  the  OMB,  or  any  other  federal  official.

2017 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms:

- Trust : 'The confidence one element has in another that the second element will behave as expected.' [3]
- Trusted : An element that another element relies upon to fulfill critical requirements on its behalf. - Trusted boot : A system boot where aspects of the hardware and firmware are measured and compared against known good values to verify their integrity and thus their trustworthiness. - Trustworthy : Worthy of being trusted to fulfill whatever critical requirements may be needed. 1

There are security and privacy concerns with allowing unrestricted container deployment orchestration. A common desire is to only use cloud servers physically located within the same country as the organization, or physically located in the same country as the origin of the information. Whenever multiple container deployments are present on a single cloud server, there is a need to segregate those deployments from each other so that they do not interfere with each other, gain access to each other's sensitive data, or otherwise compromise the security or privacy of the containers. NIST IR 8320A, Hardware-Enabled Security: Container Platform Security Prototype [1] provides an overview of challenges organizations may face when using cloud-based container workloads, as well as techniques to improve the security of cloud computing and accelerate the adoption of cloud computing technologies by establishing an automated hardware root-of-trust method for enforcing and monitoring platform integrity and geolocation restrictions for cloud servers. The motivation behind this use case is to build upon the stages of NIST IR 8320A and implement additional techniques that leverage hardware roots of trust in server platforms. The integrity and location data of each host are leveraged in the orchestration and protection of workloads, as well as providing workloads access to specific data.

Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to 2016 NIST_ITL Cybersecurity Program Annual Report:

3                                                                                | BACKGROUND INFORMATION OF ANNUAL REPORT..................................................................................................................

2016 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cell Phone Forensic Tools_ an Overview and Analysis:

orcement Standards (OLES), the U. S. Department of Defense, Federal Bureau of Investigation (FBI), U.S. Secret Service, the U.S. Immigration and Customs Enforcement (BICE), and other related agencies.
·

The scenarios define a set of prescribed activities used to gauge the capabilities of the forensic tool to recover information from a phone, beginning with connectivity and acquisition and moving progressively toward more interesting situations involving common applications, file formats, and device settings. The scenarios are not intended to be exhaustive or to serve as a formal product evaluation. However, they attempt to cover a range of situations commonly encountered when examining a device (e.g., data obfuscation, data hiding, data purging) and are useful in determining the features and functionality afforded an examiner.

Cell Phone Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

| Target Audience..............................................................................................
| 2                                                                                |
|                                                                                | 1.3                                                                                | Relationship to Other Publications.................................................................. | 3                                                                                |
|                                                                                | 1.4                                                                                | Document Conventions................................................................................... | 3                                                                                |
|                                                                                | 1.5                                                                                | Publication Organization.................................................................................

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

Scott Rose Wireless Networks Division Communications Technology Laboratory

For additional information on NIST's Cybersecurity programs, projects, and publications, visit the Computer  Security  Resource  Center.  Information  on  other  efforts  at  NIST,  the  Information Technology  Laboratory  (ITL)  and  Communications  Technology  Laboratory  (CTL)  is  also available. Zero trust related information is also found on the zero trust topic page.

National Institute of Standards and Technology Attn: Wireless Networks Division, Communications Technology Laboratory 100 Bureau Drive (Mail Stop 8920) Gaithersburg, MD 20899-8920

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines on Mobile Device Forensics:

Files and keychain elements are both protected by one of a number of access control keys, which are also encrypted in a way that incorporates the user's device passcode. The passcode


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

...............................11  |
| 2.5.1. Speaker Viewpoints....................................................................................................................11        |
| 2.5.2.
Key Highlights .............................................................................................................................13  |
| 3. Summary and Road Ahead ...........................................................................................................15                |
| Appendix A. Workshop Agenda........................................................................................................16                  |
| List of Figures                                                                                |
| Fig. 1. Components for securing microelectronics................................................................................1                      |
| Fig. 2. Distribution of workshop participants.......................................................................................2                  |

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

The verifier  SHOULD  determine the performance and integrity of the sensor and its
associated endpoint. This increases the likelihood of detecting injection attacks due to
compromised endpoints, sensor emulators, and similar threats. Acceptable methods for
making this determination include:

• The provenance (e.g., manufacturer or supplier certification), health, and integrity

Malicious code on the endpoint
proxies allows remote access to a
connected authenticator without
the subscriber’s consent.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

----------------------------------------------------------------------|
| 2) Initiate Attack Internally | The attacker is inside the boundary and initiates attack on some assessment object internally.
Examples include: User opens spear phishing email or clicks on attachment; user installs unauthorized software or hardware; unauthorized personnel gain physical access to restricted facility. | Block or Limit Internal Access: Prevent or minimize access of potentially unauthorized/compromised devices to trusted network resources; Reduce amount of time unauthorized devices are present before detection. |

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

3.1.3 Infection of Malware and Ransomware                                                                                | ... 3.1.3 Infection of Malware and Ransomware

Malware is the general term for any program that is designed to damage, disrupt, or provide means to compromise a device.

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption:

There  may  be  references  in  this  publication  to  other  publications  currently  under  development  by  NIST  in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until  each  publication  is  completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative.  For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST

Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Computer Security Training & Awareness Course Compendium:

|-------------------------------------------------------------------------------------|-----------------------------------------------------------------------| | DATA CENTER RECOVERY PLANNING (M2040) | 20 | | DATA COMMUNICATIONS SECURITY | 28 | | DATA SECURITY PLANNING: STRATEGIES FOR EFFECTIVE INFORMATION SECURITY (W9898) | 22 | | DATA SECURITY PLANNING | 68 | | DATABASE SECURITY SEMINAR | 65 | | DETECTING AND PREVENTING COMPUTER FRAUD | 11 | | DEVELOPING COMPUTER SECURITY POLICIES & PROCEDURES | 28 | | DISASTER RECOVERY PLANNING | 70 | | DISASTER RECOVERY PLANNING: STRATEGIES TO DEVELOP & MAINTAIN PROVABLE | DISASTER RECOVERY PLANNING: STRATEGIES TO DEVELOP & MAINTAIN PROVABLE | | RECOVERY CAPABILITY (W9912) | 20 | | EDI: New Frontiers For Auditors | 56 | | EDP AUDITING - CIS 433 | 78 | | EDP CONCEPTS FOR BUSINESS | 6 | | EDP AUDITING: THE FIRST STEP | 52 | | EXECUTIVE AIS SECURITY BRIEFING | 8 | | FEDERAL AIS COMPUTER SECURITY REQUIREMENTS | 4 | | FUNDAMENTALS OF COMPUTER SECURITY FOR FEDERAL INFORMATION SYSTEMS | 64 | | HOW TO MANAGE AN INFORMATION SECURITY PROGRAM: A GUIDE FOR NEWLY APPOINTED MANAGERS | 23 | | IMPLEMENTING & MANAGING A COMPUTER SECURITY PROGRAM | 19 | | IMPLEMENTING AND TESTING THE DISASTER RECOVERY PLAN | 88

Computer Security Training & Awareness Course Compendium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

| | | | | | | | PAGE | PAGE | PAGE | PAGE | PAGE | PAGE | PAGE | PAGE | PAGE | PAGE | |-------------------|-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|------------------------------------|------------------------------------|------------------------------------|--------|--------|--------|--------|--------|--------|--------|--------|--------|--------| | ABSTRACT | ABSTRACT | ABSTRACT | | | | | i | i | i | i | i | i | i | i | i | i | | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | EXECUTIVE SUMMARY | | | | | ii | ii | ii | ii | ii | ii | ii | ii | ii | ii | | LIST | OF APPENDICES | OF APPENDICES | | | | | v | v | v | v | v | v | v | v | v | v | | 1 | INTRODUCTION | | | | | | | | | | | | | | | | | | 1.1 | Development of Security Technology | Development of Security Technology | Development of Security Technology | Development of Security Technology | Development of Security Technology | 1-1 | 1-1 | 1-1 | 1-1 | 1-1 | 1-1 | 1-1 | 1-1 | 1-1 | 1-1 | | | 1.2 |

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines on Electronic Mail Security:

| 5.3 Checklist for Securing the Mail Server Operating System.......................................5-7 | 5.3 Checklist for Securing the Mail Server Operating System.......................................5-7 | | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------| | Securing Mail | Servers and | Content................................................................................6-1 | | 6.1 Hardening the Mail Server Application.....................................................................6-1 | 6.1 Hardening the Mail Server Application.....................................................................6-1 | | | 6.1.1 | Securely Installing the Mail Server | ...............................................................6-1 | | 6.1.2 | Configuring Operating System and Mail Server Access Controls | ................6-1 | | | Protecting Email from Malware................................................................................6-3 | | | 6.2 6.2.1 | Malware Scanning........................................................................................6-5 | | | 6.2.2 | Content Filtering | ...........................................................................................6-9 | | 6.2.3 | User Awareness | .........................................................................................6-12 | | 6.3 | Blocking Spam-Sending Servers | ...........................................................................6-13 | | 6.4 | Authenticated Mail Relay | .......................................................................................6-14 | | 6.5 | Secure Access.......................................................................................................6-14 | | | 6.6 | Enabling Web Access............................................................................................6-15 | | | 6.7 | Checklist for Securing Mail Servers and Content | ..................................................6-16 | | Implementing a Secure Network Infrastructure ............................................................7-1 | Implementing a Secure Network Infrastructure ............................................................7-1 | | | 7.1 | Network Composition and Structure | ........................................................................7-1 | | | 7.1.1 Inadvisable Network Layout | .........................................................................7-1 | | 7.1.2 | Demilitarized Zone........................................................................................7-1 | | | | 7.1.4 Management Network | ..................................................................................7-5


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Physical Protection?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

| Access Control                    | Maintenance         | Security Assessment and Monitoring   |
|-----------------------------------|---------------------|--------------------------------------|
| Awareness and Training            | Media Protection    | System and Communications Protection |
| Audit and Accountability          | Personnel Security  | System and Information Integrity     |
| Configuration Management          | Physical Protection | Planning                             |
| Identification and Authentication | Risk Assessment     | System and Services Acquisition      |
| Incident Response                 |                     | Supply Chain Risk Management         |

A.03.04.05[01]: physical access restrictions associated with changes to the system are defined and documented.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications:

| The sum of the log 2 distances between matching L- bit templates, i.e., the sum of the number of digits in the distance between L- bit templates. See Sections 2.9 and 3.9.
|
| π                             | 3.14159… unless defined otherwise for a specific test. |
| σ                             | The standard deviation of a random variable = ( ) ∫ - f ( x )dx x 2 µ . |
| σ 2                           | The variance of a random variable = (standard deviation) 2 . |
| s obs                         | The observed value which is used as a statistic in the Frequency test. |
| S n                           | The n th partial sum for values X i = {-1, +1}; i.e., the sum of the first n values of X i . |
| Σ                             | The summation symbol. |
| Φ                             | Standard Normal Cumulative Distribution Function (see Section 5.5.3). |
| ξ j                           | The total number of times that a given state occurs in the identified cycles. See Section 2.15 and 3.15. |
| X i                           | The elements of the string consisting of ± 1 that is to be tested for randomness, where X i = 2 ε i - 1. |

A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

The Minimum Security Requirements for Multi-User Operating Systems (MSR) document provides basic commercial computer system security requirements applicable to both government and commercial organizations. These requirements include technical measures that can be incorporated into multi-user, remote-access, resource-sharing, and information-sharing computer systems. The MSR document was written from the prospective of protecting the confidentiality and integrity of an organization's resources and promoting the continual availability of these resources. The MSR presented in this document form the basis for the commercially oriented protection profiles in Volume II of the draft Federal Criteria for Information Technology Security document (known as the Federal Criteria). The Federal Criteria is currently a draft and supersedes this document. | SECTION   | SECTION      | SECTION                                                     | PAGE   |
|-----------|--------------|-------------------------------------------------------------|--------|
|           | Abstract     |                                                             | ii     |
| 1.

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Threat Analysis on UOCAVA Voting Systems provide? (Part 2)

[Assistant]
| EXECUTIVE SUMMARY..........................................................................................................
1     |
|-----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| 1 INTRODUCTION................................................................................................................. | 1 INTRODUCTION................................................................................................................. | 1 INTRODUCTION................................................................................................................. | 3                                                                                |
| 1.1                                                                                | 1.1                                                                                | SCOPE ..............................................................................................................................

A Threat Analysis on UOCAVA Voting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

|
| Encryption.....................................................................................................
| 26                                                                                |
| Data Loss Prevention.................................................................................... | 26                                                                                |
| Media Sanitization......................................................................................... | 27                                                                                |
| Event Logging............................................................................................... | 27                                                                                |
| Forensics ...................................................................................................... | 28                                                                                |
| 7. Capabilities Mapping to Manufacturing Profile .................................................30                  |                                                                                |
| 8. Laboratory Environment                                                                                | Overview.....................................................................60                        |
| Process-based Manufacturing System .........................................................

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Quick Start Guide for Populating Mobile Test Devices:

---------------------------|
| Profile information, Status updates, personal messages, etc. | Facebook/Facebook messenger | Profile related data (picture, bio), Status updates, personal messages, etc.
|
|                                                              | Twitter                     | Profile related data (picture, bio), Tweets, personal messages, etc. |
|                                                              | LinkedIn                    | Profile related data (picture, bio), personal messages, etc. |
|                                                              | Instagram                   | Profile related data (picture, bio), Posted pictures, videos, etc. |

Quick Start Guide for Populating Mobile Test Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Computer Security Log Management:

Much of this information, particularly for applications that are not used through unencrypted network communications, can only be logged by the applications, which makes application logs particularly valuable for application-related security incidents, auditing, and compliance efforts. However, these logs are often in proprietary formats that make them more difficult to use, and the data they contain is often highly context-dependent, necessitating more resources to review their contents. Communications between log management infrastructure components typically occur over an organization's regular networks because the hosts generating log data may be located throughout the organization's networks. However, a physically or logically separate logging network can be used, particularly for getting logs from key devices (e.g., firewalls and network intrusion detection systems that often transfer large amounts of log data) and for transferring log data between log servers. During a widespread malware incident or other network-based attack, regular networks might be unstable or unavailable. Another motivation for using a separate logging network is protecting log data on the organization's regular networks from eavesdropping. If a separate logging network is not used, logging communications on the regular network could be protected using additional security controls, such as data encryption. Another benefit of having a separate logging network is protecting those components that are only used for log management from attacks. - -Log compression is storing a log file in a way that reduces the amount of storage space needed for the file without altering the meaning of its contents. Log compression is often performed when logs are rotated or archived. - -Log reduction is removing unneeded entries from a log to create a new log that is smaller. A similar process is event reduction , which removes unneeded data fields from all log entries.

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Maintenance?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

| . . . . . . . . . . . . . . . . . . . . . . . . . . 3                                                          |
| 1.3.3 New Features . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . . .
4                                                                  |
| 1.3.4 Deprecated and Removed Features . . . . . | . . . . . 4                                                                                |
| 1.3.5 FIPS 201 Version Management . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4                                                      |
| 1.3.6 Section Number Stability . . . | . . . . . . . . . . . 5                                                                                |
| 1.4 Document Organization . . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5                                                    |
| 2. Common Identification, Security, and Privacy Requirements . . . . . . . . . | 2. Common Identification, Security, and Privacy Requirements . . . . . . . . . |
| 2.1 Control Objectives . . . . . . | . 7 . . . . . . . . . . . . . . . . . . . . . . . . . 7                                                        |
| 2.2 Credentialing Requirements . . . . . . . . . . | . . . . . . . . . . . 8                                                                                |
| 2.3 Biometric Data Collection for Background Investigations . . . | . . . . . . . . . . . . . . . 9                                                                                |
| 2.4 Biometric Data Collection for PIV Card . . . . . . . . . . | . . . . . . . . . . . . . . . . . . 9                                                                          |
| 2.5 Biometric Data Use . . . | . . . . . . . . . . . . . . . . . . . 10                                                                       |
| 2.6 PIV Enrollment Records . . . . . | . . . . . . . . . . . . . . . . . . . .

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Guide to Secure Web Services:

3.1.1                                                                                | Service Chaining ... 3.1.1 Service Chaining

Sometimes, a service provider may not be able to perform the actions that a user or requester wishes it to perform, but it knows of a remote Web service that can. 3.1.1 C and C++

There are many cases where Java, .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

l innovation, the Framework is technology neutral. The Framework relies on a variety of existing standards, guidelines, and practices to enable critical infrastructure providers to achieve resilience.
By relying on those global standards, guidelines, and practices developed, managed, and updated by industry, the tools and methods available to achieve the Framework outcomes will scale across borders, acknowledge the global nature of cybersecurity risks, and evolve with technological advances and business requirements. The use of existing and emerging standards will enable economies of scale and drive the development of effective products, services, and practices that meet identified market needs. Market competition also promotes faster diffusion of these technologies and practices and realization of many benefits by the stakeholders in these sectors.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.14. Digital Injection Prevention and Forged Media Detection . . . . . . . . .

• Cryptographic verification of the source and integrity of digital evidence or

2. Based on the results of its privacy risk assessment, the CSP  SHALL  document the
measures it takes to maintain the disassociability, predictability, manageability,
confidentiality, integrity, and availability of any personal information it collects
or processes.4 In determining such measures, the CSP  SHOULD  apply relevant
guidance and standards, such as the NIST Privacy Framework [NIST-Privacy] and
NIST SP 800-53 [SP800-53].

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

|  SP 800-30, Risk Management Guide for Information Technology Systems                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|  Draft SP 800-30 Revision 1, Guide for Conducting Risk Assessments  SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach  SP 800-40 Version 2.0, Creating a Patch and Vulnerability Management Program  SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy  SP 800-48 Rev.

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Information Security Handbook_ A Guide for Managers provide? (Part 3)

[Assistant]
thank the many people who assisted with the development of this handbook. NIST management officials who supported this effort include: Joan Hash, William C. Barker, Elizabeth Chew, and Matthew Scholl.
The authors would like to thank Elizabeth Lennon, Alicia Clay, Elizabeth Chew, Richard Kissel, Carol Schmidt, Matthew Scholl, and Patricia Toth who assisted with reviewing this Handbook and provided comments and suggestions for improvement. Additional drafters of Handbook chapters include:

Ron Ross, Tim Grance, and Marianne Swanson, NIST. Nadya Bartol, Joe Nusbaum, Laura Prause, Will Robinson, Karen Kent, and Randy Ewell, BAH,

In addition, special thanks are due those contractors who helped craft the Handbook, prepare drafts, and review materials:

Nadya Bartol of Booz, Allen, Hamiliton (BAH), served as Project Manager for BAH on this project. In addition, many BAH employees contributed to the Handbook, including: Anthony Brown, Linda Duncan, Gina Jamaldinian, Sedar Labarre, Ines Murphy, Steven Peck, Mike Kapetanovic, Michael Rohde, Jacob Tsizis, Aderonke Adeniji, and Marge Spanninger. The authors also gratefully acknowledge and appreciate the many contributions from individuals in the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication. ## Errata

The following changes have been incorporated into Special Publication 800-100. 1. Chapter 10 Risk Management, Figure 10-1. Risk Management in the System Security Life Cycle diagram has been modified to remove numbers from diagram and to show the steps clearly in the risk management process in the system security life cycle. 2. Chapter 10 Risk Management, Table 10-1. Risk Level Matrix has been modified to correct the math in the diagram. vi

## Table of Contents

| 1. Introduction .................................................................................................... | 1.

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective:

rom neighboring jurisdictions or inter-governmental jurisdictions (i.e., state or Federal) need to be integrated into the response, along with the information and communications technologies they use.
In a cloud ecosystem, a cloud consumer's ability to comply with any business, regulatory, operational, or security requirements in a cloud computing environment is a direct result of the service and deployment model adopted by the agency, the cloud architecture, and the deployment and management of the resources in the cloud environment. Leveraging NIST's initial cloud computing definition and architecture, the two international standards developers have developed and approved a standardized cloud vocabulary [ISO/IEC 17788 | Recommendation ITU-T Y.3500], and a cloud architecture [ISO/IEC 17789 | Recommendation ITU-T Y.3502]. These standards create a strong foundation for the majority of the current cloud standards development, such as Application Security Validation [ISO/IEC 27034-4], Electronic Discovery [ISO/IEC 27050], Service Level Agreement Framework - Part 4: Security and Privacy [ISO/IEC 19086-4], Guidelines for security of supply chain security-cloud services [ISO/IEC CD 27036-4], and Code of practice for information security controls for cloud services [ISO/IEC FDIS 27017] to list a few of them. Recently approved is a Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors [ISO/IEC 27018:2014]. Other architectural efforts come from the OpenStack Foundation. OpenStack is an open source set of software tools for building and managing cloud computing platforms for public and private clouds. The Institute of Electrical and Electronics Engineers (IEEE) has three projects underway addressing intercloud communications, cloud portability and interoperability profiles, and adaptive management of cloud computing environments.

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Version 1.1 Manufacturing Profile provide? (Part 4)

[Assistant]
updates include managing cybersecurity within the supply chain, self-assessing cybersecurity risk, vulnerability disclosure, system integrity, and more comprehensive controls for identity management.
Additional changes include updating language to change references from 'security levels' to 'impact levels.'

## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Executive Summary

This document provides the Cybersecurity Framework implementation details developed for the manufacturing environment. The 'Manufacturing Profile' of the Cybersecurity Framework can be used as a roadmap for reducing cybersecurity risk for manufacturers that is aligned with manufacturing sector goals and industry best practices. The Profile gives manufacturers:

- A method to identify opportunities for improving the current cybersecurity posture of the manufacturing system
- An evaluation of their ability to operate the control environment at their acceptable risk level
- A standardized approach to preparing the cybersecurity plan for ongoing assurance of the manufacturing system's security

The Profile is built around the primary functional areas of the Cybersecurity Framework which enumerate the most basic functions of cybersecurity activities.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide for Cybersecurity Event Recovery:

blication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.
| Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi     | Executive Summary...................................................................................................................vi                                                                                | Executive Summary...................................................................................................................vi   |
|--------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction .........................................................................................................................1 | 1. Introduction .........................................................................................................................1 | 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Platform Firmware Resiliency Guidelines:

1 | | | 1.1 | Purpose ..........................................................................................................................1 | | | 1.2 | Audience........................................................................................................................1 | | | 1.3 | Applicability and Scope.................................................................................................2 | | | 1.4 | Document Structure.......................................................................................................2 | | 2 | Platform Architecture ..........................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Information System Security Best Practices for UOCAVA-Supporting Systems:

Every server has at least one way to manage it, and often has at least a few. Some servers are managed directly on the server themselves, using keyboards and monitors attached directly to the servers.
More and more, however, servers are managed by workstations (often regular PCs) that access them through local networks and/or the Internet. In the latter case, management access control for the server also means access control for any workstation that can manage the server through its remote interface. Thus, the scope of access control is often much wider than just that of the server itself. It is important to recognize that the management of any particular computer can be done in many ways, not just one.

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Usability and Security Considerations for Public Safety Mobile Authentication:

| .........................................................................................................
2                  |
| 2                                                                                | Usability of Authentication for Public Safety.......................................................3                        | Usability of Authentication for Public Safety.......................................................3                        |
| 2.1                                                                                | Why Usability Matters for Public Safety .......................................................... | 3                                                                                |
| 2.2                                                                                | Usability Research Methodology                                                                                | .................................................................... 3                                                       |
| 2.3                                                                                | Qualitative Data from Public Safety SMEs......................................................

Usability and Security Considerations for Public Safety Mobile Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.8 (NIST 3.2.8)?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

3.2.8                                                    | Device Hacking                                           | 17              |
|                                                          | 3. 3.2.8 Device Hacking

Within the security context, participants mentioned that they were concerned about their devices being hacked by unauthorized or malicious actors, as expressed by one participant who worried that hackers would be able to 'shut o GLYPH<11> , or dismantle, or mess with the system that I have in place' (P37\_A) .

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

ices, including tasks to perform all required security functions (e.g., SBOM generation, vulnerability scanning, code building, code signing, introduction of new testing tools, conducting audit etc.).
Specifically, in some instances, members of the security team may be responsible for designing, building, and maintaining Policy as Code and the associated pipeline. - Infrastructure team - Members of this team create, maintain, and upgrade the infrastructure. - QA team - Members of this team develop integration test cases. - Deployment team/release team - Members of this team create pipelines and packages for various environments (UAT/PreProd/Prod) and perform the configuration and provisioning appropriate for these environments.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Secure Web Services:

for setting the standards for authentication, authorization, encryption, and nonrepudiation. The provider communicates its requirements through the extensibility of WSDL, a discovery service, or both.
Some requirements may be negotiable, allowing requesters and providers to dynamically determine how to proceed, but at this time WSDL and discovery services do not provide a standard way for negotiating such requirements. Standards are under development to address this shortcoming.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

.....................21        |
| 2.3.2. Risk Avoidance ............................................................................................................................22       |
| 2.3.3.
Risk Transfer................................................................................................................................22     |
| 2.3.4. Risk Mitigation.............................................................................................................................23      |
| 2.3.5. Relationship of Risk Response to Risk Strategy ..........................................................................26                         |
| 2.3.6. Implicit Acceptance.....................................................................................................................28          |
| 2.3.7. Responding to Positive Risk Scenarios ........................................................................................30                    |
| 2.4.1. Risk Response Cost......................................................................................................................31          |
| 2.4.2. Risk Response Description ..........................................................................................................32              |
| 2.4.4. Status...........................................................................................................................................34 |
| Conclusion ...................................................................................................................................36           |
| 3. |
| Appendix B. Change Log...................................................................................................................41                |

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Application Container Security Guide:

3.3.2 不正アクセス                                                                                | ... 3.3.2 不正アクセス

多くの場合、オーケストレータには、組織内ですでに使用されている一般的なディレクトリとは別の、独自の認証デ ィレクトリサービスが含まれている。これらのシステムは厳密に管理されていないため、オーケストレータ内のより 弱いアカウント管理の慣行と、 「孤立した」アカウントの原因となる可能性がある。これらのアカウントの多くは、 オーケストレータ内で高い特権を与えられているので、これらのアカウントの侵害が、システム全体の侵害につなが る可能性がある。

コンテナは通常、オーケストレーションツールによって管理されるホスト固有ではないデータストレージボリューム を使用する。なぜなら、コンテナはクラスタ内の任意のノードで実行できるため、コンテナ内のアプリが要求するデ ータは、コンテナが実行されているホストに関係なく、コンテナで使用できる必要があるからである。同時に、多く の組織では、不正アクセスを防ぐために、保存時に暗号化する必要があるデータを管理している。

## 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

## 3.2.2.2 Reduce Insider Threat of Unauthorized Device Sub-Capability and Defect Check HWAM-L02

| Sub-Capability Name                          | Sub-Capability Purpose                                                                                |
|----------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Reduce insider threat of unauthorized device | Require multiple persons to authorize adding a device to the authorization boundary (i.e., apply the principle of separation of duties) to limit the ability of a single careless or malicious insider to authorize devices. Note 1: The organization might choose to use access restrictions to enforce the separation of duties. If so, that would be assessed under the PRIV capability. What is assessed here is that the separation of duties occurs. Note 2: See HWAM-L11 for authorization boundary.

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide to LTE Security provide?

[Assistant]
## NIST Special Publication 800-187

## Guide to LTE Security

Jeffrey Cichonski Joshua M . Franklin Michael Bartock

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-187

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-187

## Guide to LTE Security

Jeffrey Cichonski Joshua M. Franklin Applied Cybersecurity Division Information Technology Laboratory

Michael Bartock Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-187

December 2017

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.